5 ms·

From what I read about Android elsewhere, if you originally connected to the network by typing its name, it will broadcast the network name when searching. If,

by cesarb 12y ago

From what I read about Android elsewhere, if you originally connected to the network by typing its name, it will broadcast the network name when searching. If, however, you originally connected to the network by selecting it on the list of nearby networks, it won't broadcast the network name when searching. There's an app called "WiFi Advanced Config Editor" (https://play.google.com/store/apps/details?id=org.marcus905.wifi.ace https://play.google.com/store/apps/details?id=org.marcus905....) which shows in detail how a saved wifi network is configured. I believe that whether it will broadcast the network name or not is displayed as the "Hidden SSID" checkbox. Edit: after trawling through the Android source code, I found the code which apparently sets the scan_ssid= value in the wpa_supplicant config file. It seems to be this one: http://androidxref.com/5.1.0_r1/xref/frameworks/opt/net/wifi/service/java/com/android/server/wifi/WifiConfigStore.java#2796 http://androidxref.com/5.1.0_r1/xref/frameworks/opt/net/wifi... If I'm reading that code correctly, it sets the "scan_ssid" variable (WifiConfiguration.hiddenSSIDVarName is a public static final String containing "scan_ssid") according to the value of the WifiConfiguration.hiddenSSID variable. As documented in the WifiConfiguration class (http://androidxref.com/5.1.0_r1/xref/frameworks/base/wifi/java/android/net/wifi/WifiConfiguration.java#276 http://androidxref.com/5.1.0_r1/xref/frameworks/base/wifi/ja...): "This is a network that does not broadcast its SSID, so an SSID-specific probe request must be used for scans."

ryan-c 12y ago
I've observed (just looked at the log to make sure) devices running Android KitKat sending probe requests for non-hidden networks.
- cesarb 12y ago
  But were these networks added by selecting from the list, or by typing their name? From what I read, that's what makes it set the internal "hidden SSID" flag, not whether the network actually has a hidden SSID or not. See for instance the post at http://forum.xda-developers.com/showthread.php?t=2634042 http://forum.xda-developers.com/showthread.php?t=2634042 ("Any network added manually with the '+' icon will have scan_ssid=1. Any network picked from the list of scan results will not have a scan_ssid property.")
  - ryan-c 12y ago
    It does this for networks picked from the scan results - I might have been mistaken about one or two networks, but I see the probes for multiple networks I'm sure I picked from the list.
    - cesarb 12y ago
      This is worrying. When I tested some time ago (at home, so next to my home SSID), I saw only a broadcast probe quickly followed by it connecting to the network. Perhaps I should try again, but powering down the AP first. Did you try the "WiFi Advanced Config Editor" or similar to see what Android thinks about these networks, to see if there's a pattern?
      - ryan-c 12y ago
        I looked at my wpa_supplicant.conf. None of the networks have scan_ssid set. I'm unsure how often this happens. I have a probe logger running 24/7 at my apartment with four radios, but it only logs the first probe it sees for a given SSID for each client radio MAC address. The only time related piece of data I have is one instance where I know there were about three days between the first time I connected to a network and when it showed up in my log, but that really doesn't say a whole log.
gkoz 12y ago
Forget Android. What does wpa_supplicant do? It's not clear from your links that any scan_ssid value achieves hiding the network names.
- ryan-c 12y ago
  From the wpa_supplicant.conf man page: scan_ssid SSID scan technique; 0 (default) or 1. Technique 0 scans for the SSID using a broadcast Probe Request frame while 1 uses a directed Probe Request frame. Access points that cloak them- selves by not broadcasting their SSID require technique 1, but beware that this scheme can cause scanning to take longer to com- plete.
  - gkoz 12y ago
    So presumably a (default) broadcast Probe Request would not disclose saved network names but somehow this doesn't appear to be true? Hence my question?
    - ryan-c 12y ago
      This may be a bug in wpa_supplicant, I'm not sure. I looked at the code, and it seems to be trying to avoid using the SSID in a probe unless this value is set to 1, but the code is structured such that the check needs to be done in many places so one of them may have omitted it. Should be in scan.c.
      - gkoz 12y ago
        Turns out it's not a bug, it's a feature called Preferred Network Offload. Some useful links can be found here: http://www.reddit.com/r/androidapps/comments/2u2ww0/dev_wifi_privacypolice_prevents_your_smartphone/coejqeu http://www.reddit.com/r/androidapps/comments/2u2ww0/dev_wifi...
        cesarb 12y ago
        > Preferred Network Offload Looks like you found the bug, thanks: https://www.eff.org/deeplinks/2014/07/your-android-device-telling-world-where-youve-been https://www.eff.org/deeplinks/2014/07/your-android-device-te... So it's a bug after all.

by cesarb 12y ago

ryan-c 12y ago

I've observed (just looked at the log to make sure) devices running Android KitKat sending probe requests for non-hidden networks.

cesarb 12y ago
But were these networks added by selecting from the list, or by typing their name? From what I read, that's what makes it set the internal "hidden SSID" flag, not whether the network actually has a hidden SSID or not. See for instance the post at http://forum.xda-developers.com/showthread.php?t=2634042 http://forum.xda-developers.com/showthread.php?t=2634042 ("Any network added manually with the '+' icon will have scan_ssid=1. Any network picked from the list of scan results will not have a scan_ssid property.")
- ryan-c 12y ago
  It does this for networks picked from the scan results - I might have been mistaken about one or two networks, but I see the probes for multiple networks I'm sure I picked from the list.
  - cesarb 12y ago
    This is worrying. When I tested some time ago (at home, so next to my home SSID), I saw only a broadcast probe quickly followed by it connecting to the network. Perhaps I should try again, but powering down the AP first. Did you try the "WiFi Advanced Config Editor" or similar to see what Android thinks about these networks, to see if there's a pattern?
    - ryan-c 12y ago
      I looked at my wpa_supplicant.conf. None of the networks have scan_ssid set. I'm unsure how often this happens. I have a probe logger running 24/7 at my apartment with four radios, but it only logs the first probe it sees for a given SSID for each client radio MAC address. The only time related piece of data I have is one instance where I know there were about three days between the first time I connected to a network and when it showed up in my log, but that really doesn't say a whole log.

gkoz 12y ago

Forget Android. What does wpa_supplicant do? It's not clear from your links that any scan_ssid value achieves hiding the network names.

ryan-c 12y ago
From the wpa_supplicant.conf man page: scan_ssid SSID scan technique; 0 (default) or 1. Technique 0 scans for the SSID using a broadcast Probe Request frame while 1 uses a directed Probe Request frame. Access points that cloak them- selves by not broadcasting their SSID require technique 1, but beware that this scheme can cause scanning to take longer to com- plete.
- gkoz 12y ago
  So presumably a (default) broadcast Probe Request would not disclose saved network names but somehow this doesn't appear to be true? Hence my question?
  - ryan-c 12y ago
    This may be a bug in wpa_supplicant, I'm not sure. I looked at the code, and it seems to be trying to avoid using the SSID in a probe unless this value is set to 1, but the code is structured such that the check needs to be done in many places so one of them may have omitted it. Should be in scan.c.
    - gkoz 12y ago
      Turns out it's not a bug, it's a feature called Preferred Network Offload. Some useful links can be found here: http://www.reddit.com/r/androidapps/comments/2u2ww0/dev_wifi_privacypolice_prevents_your_smartphone/coejqeu http://www.reddit.com/r/androidapps/comments/2u2ww0/dev_wifi...
      - cesarb 12y ago
        > Preferred Network Offload Looks like you found the bug, thanks: https://www.eff.org/deeplinks/2014/07/your-android-device-telling-world-where-youve-been https://www.eff.org/deeplinks/2014/07/your-android-device-te... So it's a bug after all.